Decoy Font: Obscuring Text from AI using Spatial Frequencies

Decoy Font is a TrueType Font (TTF) designed to hide actual text from AI scrapers and OCR systems by presenting a decoy message to high-resolution viewers while revealing the true message to humans at a distance. By leveraging the principles of hybrid images, the font allows a single character space to communicate two different letters simultaneously depending on the spatial frequency of the observation.

How Decoy Font Works: Spatial Frequencies and Hybrid Images

Decoy Font functions by separating information into different spatial frequencies. The foreground consists of thin, sharp outlines that form a "decoy" message, while the background consists of a low-frequency, blurred mass that forms the "hidden" message.

  • Up Close (High Frequency): When viewed closely or processed by an AI that analyzes pixels at a high resolution, the sharp outlines of the decoy text dominate the visual field.
  • From a Distance (Low Frequency): When the viewer moves away from the screen or squints, the high-frequency details blur, and the low-frequency background mass becomes the dominant visual element, revealing the hidden message.

This technique is based on the well-studied concept of hybrid images, famously exemplified by the image that blends Albert Einstein and Marilyn Monroe, where the appearance changes based on the observer's distance from the image.

Effectiveness Against AI and LLMs

Decoy Font aims to deter AI scrapers and casual observation by creating an initial point of confusion for Large Language Models (LLMs) and OCR engines. Because most AI systems process images at a specific scale, they often prioritize the high-frequency foreground text.

Performance Observations

  • Initial Failure: The creator notes that models like ChatGPT and Gemini 3.5 (with Thinking) struggle to read the hidden message when passed a single screenshot of the font.
  • Prompt-Based Recovery: Community feedback suggests that some frontier models can bypass this if specifically prompted to look for a hidden message. For example, users reported that GPT-5.6 and Hermes (using GPT-5.5) were able to identify the hidden text after being told it existed.
  • Resolution Sensitivity: Some users observed that downsampling an image (e.g., to 150x150 pixels) makes the hidden message easier for models like Gemma 4B to read, as it effectively simulates the "squinting" or distance effect.

Technical Implementation and Accessibility

Decoy Font is provided as a standard TTF file, making it more accessible than other anti-AI experiments (such as Ghost Font, which requires animation). It is derived from DejaVu Sans Mono and is free for personal, commercial, and client projects.

Potential Use Cases

  • CAPTCHAs: The creator suggests using this technique to create more human-centric verification systems.
  • Private Messaging: Sending messages that are visually obscured from automated scrapers.
  • Benchmarking: Using the font as a test for the visual intelligence and scale-invariance of frontier LLMs.

Community Critiques and Technical Counterpoints

While the project is praised as a creative piece of "art," technical users have raised several concerns regarding its utility as a security measure:

"Is it useful? No. Does it stop AI from reading it? Also no. But is it cool? Yes, it is very cool."

Key Technical Limitations

  • Algorithmic Decoding: Users pointed out that a simple blur filter or a Python script using the PIL library could likely normalize the image to make the hidden text trivially readable by any standard OCR software.
  • Image Processing Tools: One user suggested using ImageMagick (magick download.png -morphology Close disk:6 output.png) to reveal the hidden message.
  • Accessibility Issues: There are concerns that the font would be unusable for people with visual impairments or those relying on screen readers, as the actual text content would be obscured or misinterpreted.
  • FFT Analysis: Some commenters noted that since the font relies on spatial frequencies, a Fast Fourier Transform (FFT) could theoretically be used by an AI to separate the two messages perfectly.

Sources

Related

  • Dispatch
    Ghost Font: Using Motion-Based Obfuscation to Combat AI OCR

    Ghost Font is an experimental video-based text delivery system that uses motion, noise, and decoy messages to make text readable to humans but difficult for AI models to decode.

  • Dispatch
    Anti-AI Fonts: Why Obfuscation is Ineffective and Harmful

    Anti-AI fonts attempt to block LLM scraping through visual obfuscation, but they fail due to multimodal AI capabilities, create accessibility barriers, and risk incentivizing a more closed, gated web.

  • Project
    isaqueseneda/shieldfont

    A typeface and encoding system that protects written work by serving decoy text to AI scrapers while rendering the original words for human readers.

  • Dispatch
    Hugging Face TextImage Augmentation pipeline release

    Hugging Face and Albumentations AI released a TextImage Augmentation pipeline that jointly modifies document images and their text, enabling realistic synthetic data generation and robust fine‑tuning of vision‑language models on limited document datasets.

  • Project
    bee-san/Ciphey

    A high-performance Rust-based decoding tool that automatically identifies and decrypts encoded text using A* search and optional BERT-powered plaintext detection.